Two features form the core of Trezor’s access control security: the PIN and the passphrase. Many users set up their PIN during initial configuration and stop there. But understanding how both layers work — and when each one protects you — is the difference between good security and excellent security.
This guide explains both features in complete detail, covering how to set them up, what happens if you enter them incorrectly, and how the full security model fits together.
The PIN: Your First Line of Defence
What the Trezor PIN Does
The PIN protects your Trezor device from unauthorised physical access. If someone picks up your Trezor and tries to use it, they cannot access any wallet functions without knowing your PIN.
The PIN is required every time you:
- Connect the Trezor to a computer (each new session)
- Wake the device from an idle timeout
- Perform certain sensitive operations within Trezor Suite
How Trezor’s PIN Entry Works (Anti-Keylogger Design)
Trezor uses a clever anti-keylogger system for PIN entry. Here is how it works:
- Your computer screen (in Trezor Suite) displays a 3×3 grid of dots or blank squares
- You click the positions on the computer screen that correspond to your PIN digits — but since the numbers are shown on the device screen, a keylogger on your computer only records mouse clicks on a blank grid, not the actual digits
This means:
- A keylogger on your computer cannot capture your PIN
- Screen recording software cannot capture your PIN
- The actual number positions change every session
PIN Length and Security
| PIN Length | Number of Combinations | Security Level |
|---|---|---|
| 1 digit | 10 | None — do not use |
| 4 digits | 10,000 | Basic |
| 6 digits | 1,000,000 | Good |
| 9 digits | 1,000,000,000 | Strong |
Trezor supports PINs up to 50 digits, but 6–9 digits is the practical sweet spot for most users. Longer PINs take more time to enter and are harder to remember.
Recommendation: Use a PIN of at least 6 digits. Avoid simple sequences (123456) or repeated digits (111111).
Setting Up Your PIN
- Connect your Trezor and open Trezor Suite
- During initial setup, you will be prompted to set a PIN
- The device will display a randomised grid with numbers
- Using the computer interface, click the positions corresponding to your chosen PIN digits
- You will be asked to confirm the PIN by entering it again
- The PIN is now set
To set or change a PIN on an existing device:
- Open Trezor Suite and connect the device
- Enter your current PIN when prompted
- Enter and confirm your new PIN
What Happens After Wrong PIN Entries
Trezor uses exponential backoff to prevent brute-force PIN attacks:
| Wrong Attempts | Wait Time Before Next Try |
|---|---|
| 1st wrong | Immediate retry |
| 2nd wrong | ~1 second |
| 3rd wrong | ~2 seconds |
| 4th wrong | ~4 seconds |
| 5th wrong | ~16 seconds |
| 6th wrong | ~64 seconds |
| After 16 wrong | Device wipes itself |
After 16 incorrect PIN attempts, the Trezor device erases itself completely. This is a deliberate security feature — it makes brute-force attacks impractical because you cannot try thousands of combinations without the device self-destructing.
This does not mean your funds are lost — your seed phrase allows complete wallet recovery on a new device.
The Passphrase: Your Advanced Security Layer
What the Passphrase Is
The passphrase (sometimes called the “25th word”) is an optional additional secret that, when combined with your 24-word seed phrase, derives a completely different set of wallet addresses.
Think of it this way:
- Your 24-word seed is a master key that opens a building
- The passphrase selects which room in that building you actually enter
- Without the passphrase, you end up in a different room (which will appear empty)
- The room with your funds only exists if you also know the passphrase
How Trezor Implements the Passphrase
Unlike the PIN, the passphrase:
The Decoy Wallet Strategy
One popular approach with passphrases is maintaining two wallets:
This is sometimes called a “plausible deniability” setup and is one of the most sophisticated personal security configurations available for self-custody.
Setting Up the Passphrase
Enabling Passphrase in Trezor Suite
- Connect your Trezor and open Trezor Suite
- Confirm on the device
Entering the Passphrase Each Session
Once enabled, each time you connect your Trezor and unlock with PIN:
- Trezor Suite will ask whether you want to enter a passphrase
- Type your passphrase (it is not displayed for security)
- The device may display the passphrase for confirmation (on touchscreen models like the Safe 5)
- Your passphrase-protected wallet is now accessible
Passphrase Entry Methods
Depending on your Trezor model:
| Model | Passphrase Entry Method |
|---|---|
| Model One | Entered on computer keyboard (passphrase displayed on device for verification) |
| Safe 3 | Can be entered on device screen or computer keyboard |
| Safe 5 | Colour touchscreen entry on device; also accepts computer keyboard input |
Entering the passphrase on the device itself (rather than the computer keyboard) is more secure, as it eliminates any keylogger risk on the computer.
PIN vs Passphrase: What Each Protects Against
| Threat | PIN Protection | Passphrase Protection |
|---|---|---|
| Stranger finds your Trezor | Strong — cannot access without PIN | Additional — even with PIN, the passphrase wallet is hidden |
| Device stolen with PIN known | None | Strong — passphrase wallet inaccessible |
| Seed phrase stolen | None | Strong — passphrase wallet requires both seed AND passphrase |
| Physical coercion (hand over wallet) | None | Strong — can hand over decoy wallet |
| Remote hack | N/A — device not internet-connected | N/A |
| Keylogger on computer | Strong — randomised grid defeats keyloggers | Moderate — passphrase entry on computer is vulnerable (use device entry) |
Full Security Model: How the Layers Fit Together
Here is the complete picture of how PIN and passphrase work together:
Layer 1: Physical Security
The device itself is secured by the PIN. No PIN access = no wallet access. After 16 wrong attempts, the device wipes.
Layer 2: Seed Phrase Backup Security
Your 24-word seed phrase allows wallet recovery on any compatible device. This must be stored securely offline. If stolen, a thief can restore your wallet on their own device — which is why the passphrase matters.
Layer 3: Passphrase
Even if your device AND seed phrase are both compromised, the passphrase-protected wallet remains inaccessible. The passphrase lives only in your memory (or in a separately secured physical backup).
Layer 4: Physical Verification
Every transaction is displayed on the Trezor screen for your confirmation. You physically approve every send — no malware can silently steal funds.
Common Passphrase Mistakes to Avoid
Changing or Removing the Passphrase
You cannot “change” a passphrase on a Trezor — the passphrase is not stored on the device. Instead:
- Create a new wallet with a new passphrase (by using a different passphrase string)
- Move your funds from the old passphrase wallet to the new one
- Stop using the old passphrase wallet
To disable passphrase entirely:
- Move all funds out of passphrase-protected wallets
- Navigate to Settings > Device and toggle off Passphrase
Frequently Asked Questions
What happens if I forget my Trezor PIN?
After 16 incorrect PIN attempts, the Trezor will wipe itself. You can then restore your wallet using your 24-word seed phrase (and passphrase, if configured). Your funds are not lost — you just need your backup materials to recover them.
Can I change my Trezor PIN?
Yes. In Trezor Suite, navigate to Settings > Device > Change PIN. You will need your current PIN to set a new one. If you have forgotten your current PIN, you will need to wipe the device and restore from seed.
Is the passphrase the same as the PIN?
No. The PIN is a number that unlocks the physical device each session. The passphrase is an additional secret (can include letters and symbols) that determines which wallet you access. They serve completely different security functions.
Where is my passphrase stored?
Nowhere — that is the point. The passphrase is never stored on the Trezor device, on your computer, or in Trezor Suite. It only exists in your memory (and optionally a physical backup). This is what makes it so secure.
Can I use multiple passphrases on one Trezor?
Yes. Each unique passphrase string generates a different wallet. You can have unlimited passphrase wallets on one device. Many users maintain a decoy wallet (empty or small amount, no passphrase) and a real wallet (full holdings, strong passphrase).
What is the maximum PIN length?
Trezor supports PINs up to 50 digits. In practice, most security-conscious users choose 6–9 digits as a balance between security and usability.
What is the maximum passphrase length?
The passphrase can be up to 50 characters. It can include uppercase and lowercase letters, numbers, spaces, and symbols. There is no minimum length — an empty passphrase is valid and simply generates the standard wallet.
Related Guides
Leave a Reply